QuasarRAT
Software · ATTACK:enterprise:S0262
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0262",
"title": "QuasarRAT",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0262",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--da04ac30-27da-4959-a67d-450ce47d9470",
"external_id": "S0262",
"domain": "enterprise",
"created": "2018-10-17T00:14:20.652Z",
"modified": "2026-05-12T15:12:00.741Z",
"version": "2.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "QuasarRAT"
},
{
"source_name": "xRAT"
},
{
"source_name": "Securelist APT10 March 2021",
"url": "https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"
},
{
"source_name": "TrendMicro Patchwork Dec 2017",
"url": "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"
},
{
"source_name": "GitHub QuasarRAT",
"url": "https://github.com/quasar/QuasarRAT"
},
{
"source_name": "Volexity Patchwork June 2018",
"url": "https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"
}
]
}Explicit source assertions (32)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a26c696-1288-4cb3-a24e-bbd64925b9f7
GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1056.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2ede8fe4-0a44-4c31-ba4c-d3282d57b4b8
Kaspersky BlindEagle AUG 2024 · GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f3ff7c9-ea14-45ad-b295-6f2f3c40cff7
CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--360f1c0d-c6ec-4d49-92a0-e8ce63559960
Kaspersky BlindEagle AUG 2024 · GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e3a5bf5-1e90-45d2-b90a-3b919f5425d5
CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRATATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1564.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41664428-398a-4b71-9418-b1bd1e4cefc4
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48281b5d-ca6f-401e-bda1-24f6537dcf1d
GitHub QuasarRATATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a33da76-c838-48fe-97ad-80d285cf165f
GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1614
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f4a052a-7e53-451f-8976-7c6f1623102d
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53e09f15-3162-4480-8eb4-709e9c18d7fb
CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRATATTACK:enterprise:G0040 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d26097f-2d6a-4642-857b-109c0f600a73
TrendMicro Patchwork Dec 2017 · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1564.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d96e66b-372a-43de-892d-30086d7ff00e
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--605478eb-c1c2-4029-bf36-9cc8981f2bee
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7037e3b3-33ea-43d6-bfa0-95178066131a
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77def9ad-52ea-44c0-b800-42b17323a985
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e9168ae-f0dd-4223-bc4b-9f94b08f99ac
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:G0140 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--878ff6f7-d372-4559-a114-8858eb2682d4
MalwareBytes LazyScripter Feb 2021ATTACK:enterprise:G0078 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9839e4e4-06c2-4f6a-8fe0-bc556e547536
Unit 42 Gorgon Group Aug 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9adf592e-f74c-46ed-95ae-85f8c45b0d5e
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f0f23ed-644d-44f5-bee9-c3f44f04a6d8
GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f259569-dfd2-4afa-aa0a-8031864c1367
Mandiant APT43 March 2024ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a552bf3d-a438-406f-8f5b-8e263adad080
DOJ APT10 Dec 2018 · Symantec Cicada November 2020 · Securelist APT10 March 2021ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a628def4-31a4-475e-b4b8-615534d8d585
GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1bd60cf-f120-4ed1-b891-0ae3fab2a725
CISA AR18-352A Quasar RAT December 2018 · GitHub QuasarRATATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba218f25-8703-4042-98b0-42afe1c49503
GitHub QuasarRAT · Volexity Patchwork June 2018ATTACK:enterprise:G0135 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc592166-c29c-4913-b8a0-ec266321a325
ESET BackdoorDiplomacy Jun 2021ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bfbabaff-1918-4a35-b5ab-8aa981e50027
CISA AR18-352A Quasar RAT December 2018ATTACK:enterprise:G0099 → uses → ATTACK:enterprise:S0262
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c303e231-4201-4c17-a3fa-bcb0bbdad0d9
Kaspersky BlindEagle AUG 2024 · Recorded Future TAG-144 AUG 2025ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1553.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf0b5987-3d37-481c-979c-36c597b91fc5
Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee60fb9b-b336-4919-a3fb-09d72dcd83e7
Kaspersky BlindEagle AUG 2024ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f120a700-dcac-4c8d-8e92-d6ba3491c2ba
CISA AR18-352A Quasar RAT December 2018 · Volexity Patchwork June 2018ATTACK:enterprise:S0262 → uses → ATTACK:enterprise:T1125
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3c0c3c1-e7a9-46ae-94cf-e128120a7c5f
GitHub QuasarRAT · Volexity Patchwork June 2018